Collaborate Disseminate
I asked if there was a specific industry term for untrusted storage that has its data integrity tracked using smaller, trusted storage. Self-encrypting drives got mentioned in the comments as an alternative. I rejected it at first because … Continue reading TCG Opal/Pyrite-like storage but without PSID reversion
I’m thinking of a scheme wherein there is a secure element with trusted storage (e.g., non-tamperable on-chip NVRAM) paired operating in conjunction with untrusted storage (e.g., any kind of mass storage like a hard drive, SSD, magnetic ta… Continue reading Conventional term for integrity-tracked storage
Correct me if I’m wrong, but seems to me that by using TPM2_PolicyNV one can create an NVRAM slot whose value can only updated to something greater than its current contents. In contrast to using a TPMA_NV_COUNTER-type NVRAM slot, this all… Continue reading Anti-rollback signing with TPM 2.0
Suppose that we have a secure/trusted system that communicates with a TPM and we want to ensure two things:
The TPM hasn’t been replaced.
The TPM is under the same ownership "session", i.e., new ownership hasn’t been taken.
Suppose that we have a secure/trusted system that communicates with a TPM and we want to ensure two things:
The TPM hasn’t been replaced.
The TPM is under the same ownership "session", i.e., new ownership hasn’t been taken.
With TPM 1.2, the access controls for a NVRAM slots were simple and straightforward. TPM 2.0, by contrast, allows for more complex controls, but these aren’t straightforward. I am using IBM’s tpm2-tools for this task and the documentation … Continue reading Creating a TPM 2.0 NVRAM that requires signature and password to be modified
TPM specifications say that TPM_NV_WRITE_STCLEAR and TPM_NV_GLOBALLOCK permissions mean an NVRAM slot can be locked until the next "TPM Reset" or the next "TPM Restart". But what is the difference between "Restart&… Continue reading TPM "Reset" versus "Restart" [closed]
There is a password for the owner hierarchy and there is a password for the platform hierarchy in the TPM 2.0 specification. What is the difference what can either do that the other cannot? How do their purposes and uses differ?
Continue reading Difference between platform and owner passwords in TPM 2.0
For an NVRAM slot, I would like to create a TPM 2.0 policy that uses TPM2_PolicyPassword. I assume that tpm2_policypassword is the tool to use to create such a policy, but the man page doesn’t tell me how to specify the desired password. H… Continue reading Create a password policy for TPM 2.0
Documentation for the tpm2_nvdefine utility mentions using a policy to control access to NVRAM areas.
-L, –policy=FILE:
Specifies the policy digest file for policy based authorizations.
What do these policies look like? How are they enf… Continue reading What is in a TPM policy?